WinWhatWhere Investigator 3.0

WinWhatWhere Investigator 3.0 (which starts at $99 per seat) has strong monitoring features and good though not great database storage features.

Unlike the other products, Investigator can display as a tray icon to indicate that it is running. As with the others, you need a password to modify settings or view the recorded data. And as with WinGuardian, you can customize a warning notice to let users know that their systems are being monitored.

You can give the program a list of EXE files to monitor or ignore, and you can limit monitoring to specific time periods. Even though you probably want to gather data into a central database, you also can use the Stealth Email feature to send the database to an e-mail address.

Investigator's reporting faculty has a lot of options but seems too canned. The view is a spreadsheetlike grid of events, such as a program launch, keystrokes, and so on. You can narrow the date ranges of the reported data and eliminate fields or narrow their range of values. But the mechanism for giving summary information, such as how many users ran a particular program yesterday, sets its own rules. The Summary Auto view determines what to summarize without any possibility of user input.

There are two levels of reporting detail: high and low. High, the default, generates a very large number of events; we found low more reasonable. But what's missing from low is not clear, since no mention of this feature is made in the Help menu, and there is no other documentation.

The other issue with the log data is that it can get very large very quickly. As with the other products, you can set Investigator to delete data older than a set period of time, such as a couple of days. Though this is wise, it obligates you to keep up with the data, or you've wasted your money on the software.

If you're interested in monitoring your systems, you should probably look somewhere other than Investigator. The architecture of its database makes supporting large numbers of users difficult, but it is well suited to a smaller workgroup.